Closed Bug 381993 Opened 13 years ago Closed 13 years ago

Crash [@ nsDOMMouseEvent::GetClientX] with mousemove generating and removing stuff

Categories

(Core :: XUL, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: sharparrow1)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

Attached file testcase
See testcase, which crashes current trunk builds.
The testcase makes use of enhanced privileges, so you need to download it to your computer to get the crash.

Talkback ID: TB32498504K
0x02c5be7b
nsDOMMouseEvent::GetClientX  [mozilla/content/events/src/nsdommouseevent.cpp, line 207]
nsXULTooltipListener::MouseMove  [mozilla/layout/xul/base/src/nsxultooltiplistener.cpp, line 213]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nseventlistenermanager.cpp, line 1203]
nsEventTargetChainItem::HandleEvent  [mozilla/content/events/src/nseventdispatcher.cpp, line 202]
nsEventTargetChainItem::HandleEventTargetChain  [mozilla/content/events/src/nseventdispatcher.cpp, line 283]
nsEventDispatcher::Dispatch  [mozilla/content/events/src/nseventdispatcher.cpp, line 477]
PresShell::HandleEventInternal  [mozilla/layout/base/nspresshell.cpp, line 5634]
PresShell::HandlePositionedEvent  [mozilla/layout/base/nspresshell.cpp, line 5523]
PresShell::HandleEvent  [mozilla/layout/base/nspresshell.cpp, line 5359]
nsViewManager::HandleEvent  [mozilla/view/src/nsviewmanager.cpp, line 1285]
nsViewManager::DispatchEvent  [mozilla/view/src/nsviewmanager.cpp, line 1238]
HandleEvent  [mozilla/view/src/nsview.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nswindow.cpp, line 1112]
NS_InvokeByIndex_P  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2245]
The stuff in the iframe is just:
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"></window>
Hmm, the testcase is not crashing.
However, the testcase that I have locally (which is the same) is crashing.
If it doesn't crash the first time, you don't need to try again before you close and reopen the browser again.
No luck with that testcase either.
Still can't reproduce (debug/non-debug) :/ 
Attached patch PatchSplinter Review
Obvious bug with a decent debugger trace.  (I put in a bunch of context because the real issue is at the call to DispatchEvent.)
Assignee: jag → sharparrow1
Status: NEW → ASSIGNED
Attachment #266173 - Flags: review?(roc)
Comment on attachment 266173 [details] [diff] [review]
Patch

ah, ofc.
Attachment #266173 - Flags: superreview?(roc)
Attachment #266173 - Flags: review?(roc)
Attachment #266173 - Flags: review+
Attachment #266173 - Flags: superreview?(roc) → superreview+
Checked in.
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Thanks, verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070529 Minefield/3.0a5pre
Status: RESOLVED → VERIFIED
Flags: in-testsuite?
Crash Signature: [@ nsDOMMouseEvent::GetClientX]
You need to log in before you can comment on or make changes to this bug.